MEDIUM

GHSA-x5hj-47vv-53p8

YUI Cross-site Scripting (XSS) vulnerability

Quick fix

GHSA-x5hj-47vv-53p8 — yui: upgrade to the fixed version with the command below.

npm install yui@3.10.11

Details

Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 3.0.0Fixed in: 3.10.11

Fixnpm install yui@3.10.11

Introduced in: 3.10.12Fixed in: 3.10.13

Fixnpm install yui@3.10.13

Packagist/moodle/moodle

Introduced in: 0Fixed in: 2.2.11

Fixcomposer require moodle/moodle:^2.2.11

Packagist/moodle/moodle

Introduced in: 2.3.0Fixed in: 2.3.8

Fixcomposer require moodle/moodle:^2.3.8

Packagist/moodle/moodle

Introduced in: 2.4.0-rc1Fixed in: 2.4.5

Fixcomposer require moodle/moodle:^2.4.5

Packagist/moodle/moodle

Introduced in: 2.5.0-betaFixed in: 2.5.1

Fixcomposer require moodle/moodle:^2.5.1

References